KUBE_APISERVER_OPTS="--logtostderr=false \
--v=2 \
--log-dir=/usr/local/k8s/logs \
--etcd-servers={%- for host in groups['etcd'] -%}
    https://{{hostvars[host]['ansible_host']}}:2379
  {%- if not loop.last -%},{%- endif -%}
{%- endfor %} \
--bind-address={{hostvars[inventory_hostname]['ansible_host']}} \
--secure-port=6443 \
--advertise-address={{hostvars[inventory_hostname]['ansible_host']}} \
--allow-privileged=true \
--service-cluster-ip-range={{k8s_service_cluster_ip_range}} \
--enable-admission-plugins=NodeRestriction \
--authorization-mode=RBAC,Node \
--enable-bootstrap-token-auth=true \
--token-auth-file=/usr/local/k8s/conf/token.csv \
--service-node-port-range={{ks8_service_node_port_range}} \
--kubelet-client-certificate=/usr/local/k8s/tls/k8s/server/server.pem \
--kubelet-client-key=/usr/local/k8s/tls/k8s/server/server-key.pem \
--tls-cert-file=/usr/local/k8s/tls/k8s/server/server.pem  \
--tls-private-key-file=/usr/local/k8s/tls/k8s/server/server-key.pem \
--client-ca-file=/usr/local/k8s/tls/k8s/ca.pem \
--service-account-key-file=/usr/local/k8s/tls/k8s/ca-key.pem \
--etcd-cafile=/usr/local/k8s/tls/etcd/ca.pem \
--etcd-certfile=/usr/local/k8s/tls/etcd/server/server.pem \
--etcd-keyfile=/usr/local/k8s/tls/etcd/server/server-key.pem \
--service-account-issuer=api \
--service-account-signing-key-file=/usr/local/k8s/tls/k8s/ca-key.pem \
--requestheader-client-ca-file=/usr/local/k8s/tls/k8s/ca.pem \
--proxy-client-cert-file=/usr/local/k8s/tls/k8s/server/server.pem \
--proxy-client-key-file=/usr/local/k8s/tls/k8s/server/server-key.pem \
--requestheader-allowed-names=kubernetes \
--requestheader-extra-headers-prefix=X-Remote-Extra- \
--requestheader-group-headers=X-Remote-Group \
--requestheader-username-headers=X-Remote-User \
--enable-aggregator-routing=true \
--audit-log-maxage=30 \
--audit-log-maxbackup=3 \
--audit-log-maxsize=100 \
--audit-log-path=/usr/local/k8s/logs/k8s-audit.log"